After signing out from chrome, the next person to sign in gets offered the option to import all settings, bookmarks and passwords. This can all be done without any authentication or verification or any security step.  All it does is ask if the last account to use chrome was also you?  Anyone can say yes, and it will merge the previous user's saved passwords right in.  This is a huge risk and breach.  Upon signing out of chrome, most would expect that a following user would have no way of accessing their saved passwords. There wasn't even a security alert email sent to let the prior use know that his full list of passwords has been breached.